Update from 2.30.1 to 2.30.3

[lolucosmin]

Before opening, please confirm:

• I have searched for duplicate or closed issues and discussions.

Language and Async Model

RxJava

Amplify Categories

Authentication

Gradle script dependencies

// Put output below this line
dependencies.add("implementation", libs.amplify.api)
dependencies.add("implementation", libs.amplify.auth)
dependencies.add("implementation", libs.amplify.core)
dependencies.add("implementation", libs.amplify.pinpoint)
dependencies.add("implementation", libs.amplify.rxbindings)
dependencies.add("implementation", libs.amplify.storage)

Environment information

------------------------------------------------------------
Gradle 8.13
------------------------------------------------------------

Build time:    2025-02-25 09:22:14 UTC
Revision:      073314332697ba45c16c0a0ce1891fa6794179ff

Kotlin:        2.0.21
Groovy:        3.0.22
Ant:           Apache Ant(TM) version 1.10.15 compiled on August 25 2024
Launcher JVM:  21.0.8 (JetBrains s.r.o. 21.0.8+-14196175-b1038.72)
Daemon JVM:    D:\Programs\Studio\jbr (no JDK specified, using current Java home)
OS:            Windows 11 10.0 amd64

Please include any relevant guides or documentation you're referencing

No response

Describe the bug

We update our project from 2.30.1 to last version 2.30.3. At this moment if a user was sign in in version 2.30.1, after update the amplify sdk looks like has a bad state a non-auth state. In our project after we initialize the amplify sdk, the session expired was controled by the SessionExpiredException and by the auth hub(AuthChannelEventName.SESSION_EXPIRED).

After update, the sdk is in non-auth state(exacly like a fresh install), we don't get any SessionExpiredException or a hub event with AuthChannelEventName.SESSION_EXPIRED and we can not logout our users to force them do re sign in.

All our sign out mechanism was based on that exception and hub event.

Reproduction steps (if applicable)

1. Use amplify 2.30.1 and do sign in.
2. Update to 2.30.3 and start the app.
3. After step 2 the sdk is in non-auth state.

Code Snippet

// Put your code below this line.

Log output

// Put your logs below this line

Configuration File

No response

GraphQL Schema

// Put your schema below this line

Additional information and screenshots

No response

[harsh62]

@lolucosmin Are you able to quickly verify if updating to 2.30.2 has the same problem?

Meanwhile I am engaging with my team to further investigate this issue. We will post an update as soon as possible.

[lolucosmin]

OK.

1. I donwgrade to 2.30.1.
2. I did a fresh install then a sign in.
3. Update to 2.30.2. Start the app and now the SDK has a "bad state". Is in non-auth state.

@harsh62 Looks like the issue is in 2.30.2. Seems like the skd state now has a different location and looks like a reset....

By the way, the problem also occurs in the opposite direction. If you install first time the last version 2.30.3 do sign in, then you donwgrade to 2.30.1 same issue.

Our big problem is we release in store with 2.30.3 and now all our users looks like they are in a bad state, the app(UI interface) can not detect this bad state to show the relogin popup(there no SessionExpiredException or AuthChannelEventName.SESSION_EXPIRED).

I know there I can do a workaround to detect manually the session state by using Auth.fetchUserAttributes or Auth.fetchAuthSession when we start the app after SKD initialization but our app has a lot of users and if we send a notification there will be issues with quotas. For this reason our logout mechanism was based on SessionExpiredException and AuthChannelEventName.SESSION_EXPIRED.

[harsh62]

@lolucosmin Thanks for giving that really good insight, we are actively looking into this on priority basis. Appreciate the patience on the issue.

[tylerjroach]

@lolucosmin Can you please provide as much information of your configuration as possible?

This would include

1. The amplify configuration file
2. Logs from a full session after adding Amplify.addPlugin(LogLevel.VERBOSE)
3. Any additional info on your Cognito setup, ex aliased logins, etc.

[tylerjroach]

I've replicated the issue. This is being looked at at our highest priority.

[lolucosmin]

@tylerjroach is a bit hard because the config is programatical is not from file we are passing a JSONObject.